ClawHub
Back to skill

Security audit

my_skill

Security checks across malware telemetry and agentic risk

Overview

This is a coherent 1Password CLI helper, but users must treat some examples as sensitive because they can print secrets or write them to local files.

Install only if you intend to let the agent help with 1Password CLI workflows. Avoid unmasked printing of secrets, do not commit generated config or key files, use restrictive file permissions for any secret output, and delete temporary secret-bearing files when finished.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The example writes secret material directly to a local file (`--out-file ./key.pem`) without any warning about secure file permissions, cleanup, or avoiding persistent storage. In a secrets-management skill, this can lead users to leave private keys readable on disk, increasing the chance of accidental exposure through backups, logs, shared workspaces, or permissive filesystem ACLs.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The `op inject -i config.yml.tpl -o config.yml` example produces a file containing injected secrets but does not warn that the generated file is now sensitive. Users may commit it to source control, leave it on shared disks, or reuse insecure defaults, causing unintended disclosure of credentials or tokens.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.